Authorization policy syntax and element reference - Object Storage Service

OSS uses JSON-based authorization policies to enforce fine-grained access control on resources. This topic provides a quick reference to the syntax and elements of these policies for configuring complex permissions.

Authorization syntax

OSS authorization policies are written in JSON and contain two core fields: Version and Statement.

Syntax

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow|Deny",
            "Action": ["oss:ActionName"],
            "Principal": ["UID|*"],
            "Resource": ["acs:oss:*:*:bucket-name/*"],
            "Condition": {
                "ConditionOperator": {
                    "ConditionKey": ["Value"]
                }
            }
        }
    ]
}

Fields

Field	Description	Required
Version	Specifies the policy version. The value must be `1`.	Yes
Statement	Specifies the core element of the policy. It contains one or more rules for allowing or denying access.	Yes

Statement elements

Element	Description	Required
Effect	Specifies whether the statement allows or explicitly denies access. Valid values are `Allow` and `Deny`.	Yes
Action	Specifies the actions that are allowed or denied. This element supports the `*` wildcard.	Yes
Principal	Specifies the principal (for example, a user, account, or role) that is granted or denied access. Setting this element to an empty array `[]` is equivalent to setting it to `[""]`. Note:* This element is not used in a RAM Policy.	Required for Bucket Policy
Resource	Specifies the resources to which the policy applies. This element supports the `*` wildcard.	Yes
Condition	Specifies conditions for when a policy is in effect. If a statement includes multiple conditions, they are evaluated with a logical AND—all must be met for the statement to apply.	No

Actions

Actions are categorized into three scopes: service-level, bucket-level, and object-level.

Service level

API	Action	Description
ListBuckets (GetService)	oss:ListBuckets	Lists all of the requester's buckets.
ListUserDataRedundancyTransition	oss:ListUserDataRedundancyTransition	Lists all of the requester's storage redundancy transition tasks.
None	oss:ActivateProduct	Activates OSS and Content Moderation.
None	oss:CreateOrder	Creates orders for OSS resource plans.
PutPublicAccessBlock	oss:PutPublicAccessBlock	Enables block public access for OSS at the account level.
GetPublicAccessBlock	oss:GetPublicAccessBlock	Retrieves the block public access configuration for OSS at the account level.
DeletePublicAccessBlock	oss:DeletePublicAccessBlock	Deletes the block public access configuration for OSS at the account level.

Bucket level

API	Action	Description
PutBucket	oss:PutBucket	Creates a bucket.
GetBucket (ListObjects)	oss:ListObjects	Lists information about all objects in a bucket.
GetBucketInfo	oss:GetBucketInfo	Retrieves information about a bucket.
GetBucketLocation	oss:GetBucketLocation	Retrieves the region of a bucket.
GetBucketStat	oss:GetBucketStat	Retrieves the storage capacity and the number of objects in a bucket.
PutBucketVersioning	oss:PutBucketVersioning	Sets the versioning state for a bucket.
GetBucketVersioning	oss:GetBucketVersioning	Retrieves the versioning state of a bucket.
ListObjectVersions (GetBucketVersions)	oss:ListObjectVersions	Lists the versions of all objects in a bucket, including delete markers.
PutBucketAcl	oss:PutBucketAcl	Sets or modifies the ACL (Access Control List) for a bucket.
GetBucketAcl	oss:GetBucketAcl	Retrieves the ACL (Access Control List) of a bucket.
DeleteBucket	oss:DeleteBucket	Deletes a bucket.
InitiateBucketWorm	oss:InitiateBucketWorm	Creates a compliance retention policy.
AbortBucketWorm	oss:AbortBucketWorm	Deletes an unlocked compliance retention policy.
CompleteBucketWorm	oss:CompleteBucketWorm	Locks a compliance retention policy.
ExtendBucketWorm	oss:ExtendBucketWorm	Extends the retention period for objects in a bucket that has a locked compliance retention policy.
GetBucketWorm	oss:GetBucketWorm	Retrieves information about a compliance retention policy.
PutBucketLogging	oss:PutBucketLogging	Enables access logging for a bucket.
PutBucketLogging	oss:PutObject	Required to write access logs to a target bucket.
GetBucketLogging	oss:GetBucketLogging	Retrieves the access logging configuration of a bucket.
DeleteBucketLogging	oss:DeleteBucketLogging	Disables access logging for a bucket.
PutBucketWebsite	oss:PutBucketWebsite	Enables static website hosting for a bucket and configures its routing rules (RoutingRule).
GetBucketWebsite	oss:GetBucketWebsite	Retrieves the static website hosting status and routing rules of a bucket.
DeleteBucketWebsite	oss:DeleteBucketWebsite	Disables static website hosting and deletes the routing rules for a bucket.
PutBucketReferer	oss:PutBucketReferer	Configures hotlink protection for a bucket.
GetBucketReferer	oss:GetBucketReferer	Retrieves the hotlink protection (Referer) configuration of a bucket.
PutBucketLifecycle	oss:PutBucketLifecycle	Sets the lifecycle rules for a bucket.
GetBucketLifecycle	oss:GetBucketLifecycle	Retrieves the lifecycle rules of a bucket.
DeleteBucketLifecycle	oss:DeleteBucketLifecycle	Deletes the lifecycle rules of a bucket.
PutBucketTransferAcceleration	oss:PutBucketTransferAcceleration	Configures transfer acceleration for a bucket.
GetBucketTransferAcceleration	oss:GetBucketTransferAcceleration	Retrieves the transfer acceleration configuration of a bucket.
ListMultipartUploads	oss:ListMultipartUploads	Lists all in-progress multipart uploads that have been initiated but not yet completed or aborted.
PutBucketCors	oss:PutBucketCors	Sets the cross-origin resource sharing (CORS) rules for a bucket.
GetBucketCors	oss:GetBucketCors	Retrieves the current cross-origin resource sharing (CORS) rules for a bucket.
DeleteBucketCors	oss:DeleteBucketCors	Disables cross-origin resource sharing (CORS) for a bucket and clears all existing rules.
PutBucketPolicy	oss:PutBucketPolicy	Sets the bucket policy for a bucket.
GetBucketPolicy	oss:GetBucketPolicy	Retrieves the bucket policy of a bucket.
DeleteBucketPolicy	oss:DeleteBucketPolicy	Deletes the bucket policy of a bucket.
PutBucketTags	oss:PutBucketTagging	Adds or modifies tags for a bucket.
GetBucketTags	oss:GetBucketTagging	Retrieves the tags of a bucket.
DeleteBucketTags	oss:DeleteBucketTagging	Deletes the tags of a bucket.
PutBucketEncryption	oss:PutBucketEncryption	Configures the server-side encryption rules for a bucket.
GetBucketEncryption	oss:GetBucketEncryption	Retrieves the server-side encryption rules of a bucket.
DeleteBucketEncryption	oss:DeleteBucketEncryption	Deletes the server-side encryption rules of a bucket.
PutBucketRequestPayment	oss:PutBucketRequestPayment	Configures the Requester Pays setting for a bucket.
GetBucketRequestPayment	oss:GetBucketRequestPayment	Retrieves the Requester Pays configuration of a bucket.
PutBucketReplication	oss:PutBucketReplication	Sets the data replication rules for a bucket.
PutBucketReplication	oss:ReplicateGet	Configures cross-account data replication or specifies a RAM role for replication.
PutBucketRTC	oss:PutBucketRTC	Enables or disables Replication Time Control (RTC) for an existing cross-region replication rule.
GetBucketReplication	oss:GetBucketReplication	Retrieves the data replication rules configured for a bucket.
DeleteBucketReplication	oss:DeleteBucketReplication	Stops data replication and deletes the replication configuration for a bucket.
GetBucketReplicationLocation	oss:GetBucketReplicationLocation	Retrieves the regions that can be used for destination buckets in a replication rule.
GetBucketReplicationProgress	oss:GetBucketReplicationProgress	Retrieves the data replication progress for a bucket.
PutBucketInventory	oss:PutBucketInventory	Configures inventory rules for a bucket.
GetBucketInventory	oss:GetBucketInventory	Retrieves a specified inventory task in a bucket.
ListBucketInventory	oss:GetBucketInventory	Lists all inventory tasks in a bucket.
DeleteBucketInventory	oss:DeleteBucketInventory	Deletes a specified inventory task from a bucket.
PutBucketAccessMonitor	oss:PutBucketAccessMonitor	Configures the access tracking status for a bucket.
GetBucketAccessMonitor	oss:GetBucketAccessMonitor	Retrieves the access tracking status of a bucket.
OpenMetaQuery	oss:OpenMetaQuery	Enables the metadata management feature for a bucket.
GetMetaQueryStatus	oss:GetMetaQueryStatus	Retrieves information about the metadata index of a bucket.
DoMetaQuery	oss:DoMetaQuery	Queries for objects that meet specified conditions, and lists object information sorted by specified fields and order.
CloseMetaQuery	oss:CloseMetaQuery	Disables the metadata management feature for a bucket.
InitUserAntiDDosInfo	oss:InitUserAntiDDosInfo	Creates an Anti-DDoS for OSS instance.
UpdateUserAntiDDosInfo	oss:UpdateUserAntiDDosInfo	Changes the status of an Anti-DDoS for OSS instance.
GetUserAntiDDosInfo	oss:GetUserAntiDDosInfo	Retrieves information about the Anti-DDoS for OSS instances under a specified account.
InitBucketAntiDDosInfo	oss:InitBucketAntiDDosInfo	Initializes Anti-DDoS protection for a bucket.
UpdateBucketAntiDDosInfo	oss:UpdateBucketAntiDDosInfo	Updates the Anti-DDoS protection status for a bucket.
ListBucketAntiDDosInfo	oss:ListBucketAntiDDosInfo	Lists the Anti-DDoS protection information for buckets.
PutBucketResourceGroup	oss:PutBucketResourceGroup	Sets the resource group to which a bucket belongs.
GetBucketResourceGroup	oss:GetBucketResourceGroup	Retrieves the ID of the resource group to which a bucket belongs.
CreateCnameToken	oss:CreateCnameToken	Creates a CNAME token required for domain name ownership verification.
GetCnameToken	oss:GetCnameToken	Retrieves a created CNAME token.
PutCname	oss:PutCname	Binds a custom domain name to a bucket.
PutCname	yundun-cert:DescribeSSLCertificatePrivateKey yundun-cert:DescribeSSLCertificatePublicKeyDetail yundun-cert:CreateSSLCertificate	Required to bind a certificate when you bind a custom domain name to a bucket.
ListCname	oss:ListCname	Lists all custom domain names (CNAMEs) bound to a bucket.
DeleteCname	oss:DeleteCname	Unbinds a custom domain name (CNAME) from a bucket.
PutStyle	oss:PutStyle	Sets an image style.
GetStyle	oss:GetStyle	Retrieves an image style.
ListStyle	oss:ListStyle	Lists image styles.
DeleteStyle	oss:DeleteStyle	Deletes an image style.
PutBucketArchiveDirectRead	oss:PutBucketArchiveDirectRead	Enables or disables direct read for Archive objects in a bucket.
GetBucketArchiveDirectRead	oss:GetBucketArchiveDirectRead	Checks whether direct read for Archive objects is enabled for a bucket.
CreateAccessPoint	oss:CreateAccessPoint	Creates an access point.
GetAccessPoint	oss:GetAccessPoint	Retrieves information about a single access point.
DeleteAccessPoint	oss:DeleteAccessPoint	Deletes an access point.
ListAccessPoints	oss:ListAccessPoints	Lists user-level and bucket-level access points.
PutAccessPointPolicy	oss:PutAccessPointPolicy	Configures a policy for an access point.
GetAccessPointPolicy	oss:GetAccessPointPolicy	Retrieves the policy of an access point.
DeleteAccessPointPolicy	oss:DeleteAccessPointPolicy	Deletes the policy of an access point.
PutBucketHttpsConfig	oss:PutBucketHttpsConfig	Enables or disables TLS version settings for a bucket.
GetBucketHttpsConfig	oss:GetBucketHttpsConfig	Retrieves the TLS version settings for a bucket.
None	oss:ReplicateList	Grants permission to list historical data in a source bucket for replication. This permission allows Object Storage Service (OSS) to list and replicate historical objects individually.
CreateAccessPointForObjectProcess	oss:CreateAccessPointForObjectProcess	Creates an Object FC access point.
GetAccessPointForObjectProcess	oss:GetAccessPointForObjectProcess	Retrieves basic information about an Object FC access point.
DeleteAccessPointForObjectProcess	oss:DeleteAccessPointForObjectProcess	Deletes an Object FC access point.
ListAccessPointsForObjectProcess	oss:ListAccessPointsForObjectProcess	Lists user-level Object FC access points.
PutAccessPointConfigForObjectProcess	oss:PutAccessPointConfigForObjectProcess	Modifies the configuration of an Object FC access point.
GetAccessPointConfigForObjectProcess	oss:GetAccessPointConfigForObjectProcess	Retrieves the configuration information of an Object FC access point.
PutAccessPointPolicyForObjectProcess	oss:PutAccessPointPolicyForObjectProcess	Configures a permission policy for an Object FC access point.
GetAccessPointPolicyForObjectProcess	oss:GetAccessPointPolicyForObjectProcess	Retrieves the permission policy configuration of an Object FC access point.
DeleteAccessPointPolicyForObjectProcess	oss:DeleteAccessPointPolicyForObjectProcess	Deletes the permission policy of an Object FC access point.
WriteGetObjectResponse	oss:WriteGetObjectResponse	Lets you customize the data and headers returned by a GetObject request.
CreateBucketDataRedundancyTransition	oss:CreateBucketDataRedundancyTransition	Creates a storage redundancy transition task.
GetBucketDataRedundancyTransition	oss:GetBucketDataRedundancyTransition	Retrieves a specific storage redundancy transition task.
DeleteBucketDataRedundancyTransition	oss:DeleteBucketDataRedundancyTransition	Deletes a storage redundancy transition task.
ListBucketDataRedundancyTransition	oss:ListBucketDataRedundancyTransition	Lists all storage redundancy transition tasks in a bucket.
PutBucketPublicAccessBlock	oss:PutBucketPublicAccessBlock	Enables block public access for a bucket.
GetBucketPublicAccessBlock	oss:GetBucketPublicAccessBlock	Retrieves the block public access configuration of a bucket.
DeleteBucketPublicAccessBlock	oss:DeleteBucketPublicAccessBlock	Deletes the block public access configuration of a bucket.
PutAccessPointPublicAccessBlock	oss:PutAccessPointPublicAccessBlock	Enables block public access for an access point.
GetAccessPointPublicAccessBlock	oss:GetAccessPointPublicAccessBlock	Retrieves the block public access configuration of an access point.
DeleteAccessPointPublicAccessBlock	oss:DeleteAccessPointPublicAccessBlock	Deletes the block public access configuration of an access point.
GetBucketPolicyStatus	oss:GetBucketPolicyStatus	Checks whether the current bucket policy allows public access.
PutBucketOverwriteConfig	oss:PutBucketOverwriteConfig	Configures overwrite protection for a bucket.
GetBucketOverwriteConfig	oss:GetBucketOverwriteConfig	Retrieves the overwrite protection configuration of a bucket.
DeleteBucketOverwriteConfig	oss:DeleteBucketOverwriteConfig	Deletes the overwrite protection configuration of a bucket.

Object level

API	Action	Description
PutObject	oss:PutObject	Uploads an object.
	oss:PutObjectTagging	Specifies object tags using `x-oss-tagging` when uploading an object.
	kms:GenerateDataKey kms:Decrypt	Uploads an object with KMS server-side encryption by specifying `X-Oss-Server-Side-Encryption: KMS` in the object metadata.
PostObject	oss:PutObject	Uploads an object to a specified bucket using an HTML form.
AppendObject	oss:PutObject	Uploads an object by appending data.
AppendObject	oss:PutObjectTagging	Specifies object tags using `x-oss-tagging` when appending data to an object.
InitiateMultipartUpload	oss:PutObject	Initiates a multipart upload task.
	oss:PutObjectTagging	Specifies object tags using `x-oss-tagging` when initiating a multipart upload.
	kms:GenerateDataKey kms:Decrypt	Initiates a multipart upload for an object with KMS server-side encryption by specifying `X-Oss-Server-Side-Encryption: KMS` in the object metadata.
UploadPart	oss:PutObject	Uploads a part based on the specified object name and upload ID.
CompleteMultipartUpload	oss:PutObject	Completes a multipart upload task after all parts are uploaded.
CompleteMultipartUpload	oss:PutObjectTagging	Completes a multipart upload task and specifies object tags after all parts have been uploaded.
AbortMultipartUpload	oss:AbortMultipartUpload	Aborts a multipart upload task and deletes the corresponding parts.
PutSymlink	oss:PutObject	Creates a symlink for a target object in OSS.
PutSymlink	oss:PutObjectTagging	Creates a symlink with specified object tags for a target object in OSS.
GetObject	oss:GetObject	Retrieves an object.
	kms:Decrypt	Downloads a KMS-encrypted object.
	oss:GetObjectVersion	Downloads a specific version of an object.
HeadObject	oss:GetObject	Retrieves the metadata of an object.
GetObjectMeta	oss:GetObject	Retrieves object metadata, including its ETag, size, and last modified time.
SelectObject	oss:GetObject	Executes an SQL statement on a target object and returns the result.
GetSymlink	oss:GetObject	Retrieves the symlink of a target object.
DeleteObject	oss:DeleteObject	Deletes an object.
DeleteObject	oss:DeleteObjectVersion	Deletes a specific version of an object.
DeleteMultipleObjects	oss:DeleteObject	Deletes multiple objects from the same bucket.
CopyObject	oss:GetObject oss:PutObject	Copies an object between buckets in the same region.
	oss:GetObjectVersion	Copies a specific version of an object between buckets in the same region.
	oss:GetObjectTagging oss:PutObjectTagging	Copies an object with specified tags between buckets in the same region.
	kms:GenerateDataKey kms:Decrypt	Copies an object and encrypts the destination object by specifying `X-Oss-Server-Side-Encryption: KMS` in the destination object's metadata.
	oss:GetObjectVersionTagging	Copies a specific version of an object with specified tags between buckets in the same region.
UploadPartCopy	oss:GetObject oss:PutObject	Uploads a part by copying data from an existing object using an `UploadPart` request with the `x-oss-copy-source` header.
UploadPartCopy	oss:GetObjectVersion	Uploads a part by copying data from a specific version of an existing object using an `UploadPart` request with the `x-oss-copy-source` header.
ListParts	oss:ListParts	Lists all successfully uploaded parts for a specified upload ID.
PutObjectACL	oss:PutObjectAcl	Modifies the ACL of an object in a bucket.
PutObjectACL	oss:PutObjectVersionAcl	Modifies the ACL of a specific version of an object in a bucket.
GetObjectACL	oss:GetObjectAcl	Retrieves the ACL of an object in a bucket.
GetObjectACL	oss:GetObjectVersionAcl	Retrieves the ACL of a specific version of an object in a bucket.
RestoreObject	oss:RestoreObject	Restores an object from the Archive Storage, Cold Archive Storage, or Deep Cold Archive Storage classes.
RestoreObject	oss:RestoreObjectVersion	Restores a specific version of an object from the Archive Storage, Cold Archive Storage, or Deep Cold Archive Storage classes.
PutObjectTagging	oss:PutObjectTagging	Sets or updates the tags for an object.
PutObjectTagging	oss:PutObjectVersionTagging	Sets or updates the tags for a specific version of an object.
GetObjectTagging	oss:GetObjectTagging	Retrieves the tags of an object.
GetObjectTagging	oss:GetObjectVersionTagging	Retrieves the tags of a specific version of an object.
DeleteObjectTagging	oss:DeleteObjectTagging	Deletes the tags of a specified object.
DeleteObjectTagging	oss:DeleteObjectVersionTagging	Deletes the tags of a specific version of an object.
PutLiveChannel	oss:PutLiveChannel	Creates a LiveChannel to upload audio and video data over RTMP.
ListLiveChannel	oss:ListLiveChannel	Lists specified LiveChannels.
DeleteLiveChannel	oss:DeleteLiveChannel	Deletes a specified LiveChannel.
PutLiveChannelStatus	oss:PutLiveChannelStatus	Switches the status of a LiveChannel between enabled and disabled.
GetLiveChannelInfo	oss:GetLiveChannel	Retrieves the configuration of a specified LiveChannel.
GetLiveChannelStat	oss:GetLiveChannelStat	Retrieves the streaming status of a specified LiveChannel.
GetLiveChannelHistory	oss:GetLiveChannelHistory	Retrieves the streaming history of a specified LiveChannel.
PostVodPlaylist	oss:PostVodPlaylist	Generates a VOD playlist for a specified LiveChannel.
GetVodPlaylist	oss:GetVodPlaylist	Retrieves the playlist generated from a specified LiveChannel's stream within a given time frame.
N/A	oss:PublishRtmpStream	Pushes audio and video data streams over RTMP.
N/A	oss:ProcessImm	Grants permission to process data in OSS using IMM.
PostProcessTask	oss:GetObject	Grants permission to process data using IMM through a POST request.
PostProcessTask	oss:PutObject	Grants permission to perform a SaveAs data processing task using IMM.
ImgSaveAs	oss:PostProcessTask	Saves a processed image to a specified bucket.
CreateOfficeConversionTask	imm:CreateOfficeConversionTask	Grants permission to convert documents or create snapshots using IMM.
GenerateWebofficeToken	imm: GenerateWebofficeToken	Retrieves a Weboffice token.
RefreshWebofficeToken	imm:RefreshWebofficeToken	Refreshes a Weboffice token.
N/A	oss:ReplicateGet	Grants read permissions for data replication. This allows OSS to read data and metadata (including objects, parts, and multipart uploads) from the source and destination buckets.
N/A	oss:ReplicatePut	Grants write permissions for data replication, allowing OSS to perform write operations on the destination bucket, such as writing objects, parts, and symlinks, and modifying metadata.
N/A	oss:ReplicateDelete	Grants delete permissions for data replication, allowing OSS to perform delete operations on the destination bucket, such as `DeleteObject`, `AbortMultipartUpload`, and creating delete markers. Note This action is required for the RAM role only when the data replication mode is set to Add/Delete/Modify/Sync.

Resource pool QoS

API	Action	Description
PutBucketQoSInfo	oss:PutBucketQoSInfo	Sets flow control for a bucket in a resource pool.
GetBucketQoSInfo	oss:GetBucketQoSInfo	Retrieves the flow control configuration for a bucket in a resource pool.
DeleteBucketQoSInfo	oss:DeleteBucketQoSInfo	Deletes the flow control configuration for a bucket in a resource pool.
PutBucketRequesterQoSInfo	oss:PutBucketRequesterQoSInfo	Sets bucket-level flow control for a requester.
GetBucketRequesterQoSInfo	oss:GetBucketRequesterQoSInfo	Retrieves the bucket-level flow control configuration for a requester.
ListBucketRequesterQoSInfos	oss:ListBucketRequesterQoSInfos	Lists all bucket-level flow control configurations for all requesters.
DeleteBucketRequesterQoSInfo	oss:DeleteBucketRequesterQoSInfo	Deletes the bucket-level flow control configuration for a requester.
ListResourcePools	oss:ListResourcePools	Lists all resource pools in the current account.
GetResourcePoolInfo	oss:GetResourcePoolInfo	Retrieves the flow control configuration for a resource pool.
ListResourcePoolBuckets	oss:ListResourcePoolBuckets	Lists the buckets in a specified resource pool.
PutResourcePoolRequesterQoSInfo	oss:PutResourcePoolRequesterQoSInfo	Sets flow control for a requester in a resource pool.
GetResourcePoolRequesterQoSInfo	oss:GetResourcePoolRequesterQoSInfo	Retrieves the flow control configuration for a requester in a resource pool.
ListResourcePoolRequesterQoSInfos	oss:ListResourcePoolRequesterQoSInfos	Lists the flow control configurations for all requesters in a specified resource pool.
DeleteResourcePoolRequesterQoSInfo	oss:DeleteResourcePoolRequesterQoSInfo	Deletes the flow control configuration for a requester in a resource pool.

Vector bucket

API	Action	Description
PutVectorBucket	oss:PutVectorBucket	Creates a vector bucket.
GetVectorBucket	oss:GetVectorBucket	Retrieves the details of a vector bucket.
ListVectorBuckets	oss:ListVectorBuckets	Lists all vector buckets owned by the requester.
DeleteVectorBucket	oss:DeleteVectorBucket	Deletes a vector bucket.
PutBucketLogging	oss:PutBucketLogging	Enables log shipping for a vector bucket.
PutBucketLogging	oss:PutObject	Writes logs to the destination bucket if log shipping is enabled.
GetBucketLogging	oss:GetBucketLogging	Retrieves the log shipping configuration of a vector bucket.
DeleteBucketLogging	oss:DeleteBucketLogging	Disables log shipping for a vector bucket.
PutBucketPolicy	oss:PutBucketPolicy	Sets the bucket policy for a vector bucket.
GetBucketPolicy	oss:GetBucketPolicy	Retrieves the bucket policy for a vector bucket.
DeleteBucketPolicy	oss:DeleteBucketPolicy	Deletes the bucket policy for a vector bucket.
PutVectorIndex	oss:PutVectorIndex	Creates a vector index.
GetVectorIndex	oss:GetVectorIndex	Retrieves the details of a vector index.
ListVectorIndexes	oss:ListVectorIndexes	Lists all vector indexes in a vector bucket.
DeleteVectorIndex	oss:DeleteVectorIndex	Deletes a vector index.
PutVectors	oss:PutVectors	Writes vector data to a vector index.
GetVectors	oss:GetVectors	Retrieves specified vector data.
ListVectors	oss:ListVectors	Lists all vector data in a vector index.
QueryVectors	oss:QueryVectors	Performs a vector similarity search.
DeleteVectors	oss:DeleteVectors	Deletes specified vector data from a vector index.

Resource

The resource element specifies which resources the policy applies to. It supports the asterisk (*) wildcard. A single bucket policy can include multiple resources.

Bucket

Category	Format	Example
Bucket level	`acs:oss:{region}:{bucket_owner_id}:{bucket_name}`	`acs:oss:::example-bucket`
Object level	`acs:oss:{region}:{bucket_owner_id}:{bucket_name}/{object_name}`	`acs:oss:::example-bucket/abc.txt`
Resource pool level	`acs:oss:{region}:{account_id}:resourcepool/{resource_pool_name}`	`acs:oss:::resourcepool/resource-pool-for-ai`

Note

The {region} field currently supports only the asterisk (*) wildcard.

Vector bucket

Resource level	Format	Example
All vector resources	`acs:ossvector:::` `acs:ossvector:::/*`	`acs:ossvector:::` `acs:ossvector:::/*`
Vector bucket	`acs:ossvector:{region}:{account_id}:{bucket_name}`	`acs:ossvector:::my-vector-bucket`
Vector index	`acs:ossvector:{region}:{account_id}:{bucket_name}/{index_name}`	`acs:ossvector:::my-vector-bucket/my-index`

Condition

The Condition element specifies the constraints under which a policy takes effect. It consists of a condition operator, a condition key, and a condition value.

Condition operators

Type	Supported operators
String	StringEquals StringNotEquals StringEqualsIgnoreCase StringNotEqualsIgnoreCase StringLike StringNotLike
Number	NumericEquals NumericNotEquals NumericLessThan NumericLessThanEquals NumericGreaterThan NumericGreaterThanEquals
Date and time	DateEquals DateNotEquals DateLessThan DateLessThanEquals DateGreaterThan DateGreaterThanEquals
Boolean	Bool
IP address	IpAddress NotIpAddress IpAddressIncludeBorder

Condition keys

Condition key	Description
acs:SourceIp	Specify a standard IP CIDR block. The asterisk (``) is supported as a wildcard. Important* When you configure a bucket policy, if you configure `acs:SourceIp`, you must also configure `acs:SourceVpc`. When you configure other policies, base the configuration on your network access architecture. We recommend that you configure both the `acs:SourceIp` and `acs:SourceVpc` conditions to achieve dual-layer access control. Using a single condition can create security blind spots. For example, if you restrict access based only on public IP addresses, a VPC can bypass the restriction by using a matching egress IP address, which results in unauthorized access.
acs:SourceVpc	Specifies the VPC, which can be a specific VPC ID or `vpc-`. Note* When you use `acs:SourceVpc` to restrict the source VPC, ensure that the selected VPC is in a region that supports OSS gateway endpoints. Otherwise, the authentication request cannot be associated with the corresponding VPC, which results in an authentication failure. For more information about the regions that support OSS gateway endpoints, see Regions that support OSS gateway endpoints.
acs:UserAgent	Specifies the HTTP User-Agent header. Type: String.
acs:CurrentTime	The time the request arrives at the OSS server. Format: ISO 8601.
acs:SecureTransport	The protocol of the request. Valid values: `true`: Allows only HTTPS requests. `false`: Allows access for HTTP requests only. If `acs:SecureTransport` is not set, both HTTP and HTTPS requests are allowed.
oss:x-oss-acl	Restricts the type of bucket ACL. Valid values: `private`: private. `public-read`: Public read. `public-read-write`: Public read-write. For more information, see bucket ACL.
oss:x-oss-object-acl	Restricts the type of object ACL. Valid values: `private`: Private. `public-read`: Public read. `public-read-write`: Allows public read and write access. `default`: Inherit the bucket ACL. For more information, see object ACL.
oss:Prefix	Used in `ListObjects` requests to list objects with a specific prefix.
oss:Delimiter	Used in `ListObjects` requests to group object names by a specified character.
acs:AccessId	The AccessKey ID included in the request.
oss:BucketTag	Specifies a bucket tag. A single BucketTag can be used as a Condition. When you configure multiple BucketTags, you must add `oss:BucketTag/` before each BucketTag to form multiple Conditions.
acs:MFAPresent	Checks whether Multi-factor Authentication (MFA) is enabled. Valid values: `true`: Multi-factor Authentication (MFA) is enabled. `false`: Multi-factor Authentication (MFA) is disabled.
oss:ExistingObjectTag	Specifies an existing tag of the requested object. A single ObjectTag can be used as a Condition. When you use multiple ObjectTags, you must prefix each ObjectTag with `oss:ExistingObjectTag/`. This mainly applies to `GetObject`, `HeadObject`, and other object read operations, as well as `PutObjectTagging`, `GetObjectTagging`, and other ObjectTagging operations.
oss:RequestObjectTag	Specifies an object tag included in the request. A single ObjectTag can be used as a Condition. If you use multiple ObjectTags, you must add the `oss:RequestObjectTag/` prefix to each ObjectTag. This primarily applies to object write operations such as `PutObject` and `PostObject`, and ObjectTagging operations such as `PutObjectTagging` and `GetObjectTagging`.

Object Storage Service:Policy syntax and elements

Authorization syntax

Syntax

Fields

Statement elements

Actions

Service level

Bucket level

Object level

Resource pool QoS

Vector bucket

Resource

Bucket

Vector bucket

Condition

Condition operators

Condition keys

Related documents